AWS IoT: Step by step guide on fleet provisioning with CSR using ESP32-S3

AWS IoT provides a secure method for fleet provisioning, enabling IoT devices to generate their own private keys and request uniquely signed X.509 client certificates upon their first connection. The process involves local key generation on the device, sending a CSR to AWS IoT Core, and then receiving the signed certificate. This method enhances security, as the private key remains on the device and cannot be transmitted or exposed during manufacturing.

It is particularly useful for hardware that utilizes a secure element, where private keys cannot be imported. Additionally, the method allows for custom certificate authorities, enabling self-managed signing with the use of a custom Public Key Infrastructure (PKI), as well as the ability to use custom validity periods and algorithms.

To implement fleet provisioning using the ESP32-S3, the setup requires Ubuntu 26.04 LTS, the esp-idf v5.5.5, and the esp-aws-iot repository. The folder structure for the demo includes the esp/, esp-aws-iot/, examples/fleet_provisioning/ and esp-idf/ directories. After setting up the environment and building the example, you can proceed with creating a provisioning policy, a claim certificate, an IAM role for fleet provisioning, and a thing policy.

The provisioning policy defines permissions and controls for creating cloud resources, connected devices, and attaching security policies. The claim certificate, a shared, bootstrap X.509 certificate and private key, is pre-installed on devices during manufacturing. An IAM role is necessary for AWS IoT to create, configure, and register resources on your behalf.

Finally, a thing policy is created for the device thing, which is generated during fleet provisioning. Using the provided JSON content, policies can be created and attached to the respective certificates and things in the AWS IoT Core.